Assessment
Why it matters
CISA lists this vulnerability as known to be exploited; exploitation is confirmed; EPSS is 78.3%; technical severity is CVSS 8.8.
Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."
Who should care
- Teams operating Windows, Windows 7, Windows Server 2003 +3 more
- Vulnerability and exposure management teams
- Security operations teams monitoring exploitation activity
Response plan
What I would do
- Confirm whether Windows, Windows 7, Windows Server 2003 +3 more is present in the environment.
- Identify affected versions and establish whether vulnerable services are exposed or reachable.
- Microsoft Security advisory 2639658
- Review relevant security telemetry for evidence of attempted or successful exploitation.
- Document the remediation decision and track it to verified completion.
Treatment intelligence
Remediation intelligence
Vendor sources are listed before government and third-party guidance. Confirm product applicability and change prerequisites before deployment.
Advisory
- Microsoft Security advisory 2639658Microsoft · Vendor sourceVerification pending ↗
- Microsoft Security advisory Ms11 087Microsoft · Vendor sourceVerification pending ↗
- Microsoft Security advisory Ms12 034Microsoft · Vendor sourceVerification pending ↗
- Microsoft Security advisory Ms12 039Microsoft · Vendor sourceVerification pending ↗
Technical details
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CWE
- Not classified
- Affected versions
- Microsoft Windows; Microsoft Windows 7 (Version - | Version -); Microsoft Windows Server 2003 (Version -); Microsoft Windows Server 2008 (Version - | Version - | Version -); Microsoft Windows Vista (Version -); Microsoft Windows Xp (Version - | Version -)
- Fixed versions
- No explicit fixed version is currently recorded.
- Published
- 4 November 2011
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
Signal timeline
- CVE published
- Added to CISA KEV
- Latest EPSS score: 78.3%
- Signal calculated at 82
External references
- CISA Government advisory CVE-2011-3402
- Blogs Technet Technical reference Microsoft Releases Security Advisory 2639658
- Secunia Technical reference
- Secunia Technical reference
- Securelist Technical reference The Mystery Of Duqu Part Two
- Securitytracker Technical reference
- Symantec Exploit information W32 Duqu Status Updates Installer Zero Day Exploit
- Symantec Technical reference W32 Duqu The Precursor To The Next Stuxnet.pdf
- Us Cert Government advisory TA11 347A
- Us Cert Government advisory TA12 129A
- Us Cert Government advisory TA12 164A
- Us Cert Government advisory ICS ALERT 11 291 01E.pdf